If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

Where do sites like Cert.org get their exploit information?

I look at www.cert.org just about every day to see what new vulnerabilites are up and about. They seem to update their site about new vulnerabilites fairly quickly (at about the same speed as MS does, maybe a bit sooner) and verify their statements not only via other sources but by claiming that exploit code is publicly available.

Out of curiosity and because I am studying to become a network security professional, I was curious as to how sites such cert discover these exploits and exploit code that is publicly available. Do they have dedicated people focusing on certain aspects of security in the OS constantly hammering away until they find a problem? I'm sure paroozing around for hacker sites is blah and risky, opening yourself up to exploit.

Any thoughts? Maybe I just lack common sense on this topic, but its fascinating I think.

Re: Where do sites like Cert.org get their exploit information?

Originally posted here by toxic.influx I look at www.cert.org just about every day to see what new vulnerabilites are up and about. They seem to update their site about new vulnerabilites fairly quickly (at about the same speed as MS does, maybe a bit sooner) and verify their statements not only via other sources but by claiming that exploit code is publicly available.

Out of curiosity and because I am studying to become a network security professional, I was curious as to how sites such cert discover these exploits and exploit code that is publicly available. Do they have dedicated people focusing on certain aspects of security in the OS constantly hammering away until they find a problem? I'm sure paroozing around for hacker sites is blah and risky, opening yourself up to exploit.

Any thoughts? Maybe I just lack common sense on this topic, but its fascinating I think.

Thanks
toxic.influx

While CERT does a lot of testing on their own and they have found some vulnerabilities most of their information comes from other internet sources, such as bugtraq, or vendor security lists. They will usually confirm the information in their own labs and provide more detail if they can. They also get a lot of information from people emailing vulnerability information directly to them.

They do have people working there full time to look for information that is on the web, or to confirm what is being written on other sites. Their FAQ answers some of the questions. It is a federally funded organization at Carnegie Mellon.

They do have people working there full time to look for information that is on the web, or to confirm what is being written on other sites. Their FAQ answers some of the questions. It is a federally funded organization at Carnegie Mellon.

Yea peeps that do nothing all day but research exploits and security holes

No, not at all. I think that very few of us are involved in that level of detail. We are more the "grunts in the front line" and need to be aware of what is going on, but don't have time to individually reinvent wheels.

Competent analyses by trustworthy sources are invaluable. CERT is one of those